refactor(atlantis-image): recombine with atlantis-base #3001

GenPage · 2023-01-18T15:31:32Z

Atlantis built and maintained two separate docker images, atlantis and atlantis-base. This made cutting releases cumbersome and had inefficiencies in the docker image layers.

This PR condenses the workflow into a single job and Dockerfile once again by utilizing multi-stage builds more heavily and Docker build targeting.

what

Removes docker-base files and GHA workflow
Streamlines additional alpine/debian build images in one dockerfile
targets alpine and debian images via a single workflow and image type matrix
improve docker image layering for cache busting.

why

had to release atlantis-base manually on to bring package updates into main image
inefficient as it would bust cache for the whole atlantis image
additional improvements and standardized how we download binary dependencies and copy them into final image

tests

I have tested my changes by:
- locally running the docker build commands:
  - DOCKER_BUILDKIT=1 docker build -f Dockerfile --platform linux/amd64 --target alpine -t atlanits-alpine .
  - DOCKER_BUILDKIT=1 docker build -f Dockerfile --platform linux/amd64 --target debian -t atlanits-debian .
- Additional testing with the GHA workflow is needed

references

Previous PR feat(build): use ~= and >= package constraints #2896

jamengual · 2023-01-18T17:48:29Z

how will the update flow look like?

if we need to update ARG ALPINE_TAG=3.17.0 ARG DEBIAN_TAG=bullseye-20221219-slim

or add a TF version?

GenPage · 2023-01-18T18:27:12Z

how will the update flow look like?

if we need to update ARG ALPINE_TAG=3.17.0 ARG DEBIAN_TAG=bullseye-20221219-slim

or add a TF version?

The same way it is right now, you'll update the Dockerfile. I purposefully left the image tags as ARGs and not ENVs incase we decide on a solution to pass in tags via the GHA workflow.

Dockerfile.dev

Dockerfile

nitrocode

Thank you for the contribution. I had a few comments

Dockerfile

.github/workflows/atlantis-image.yml

Dockerfile

nitrocode · 2023-01-23T03:01:56Z

Dockerfile

+RUN apk add --no-cache \
+        ca-certificates~=20220614 \
+        curl~=7.87 \
+        git~=2.38 \


Does git~=2.38 allow the latest git 2.39 to be installed without using the separate package repo?

Ref: #2998

I doesn't appear to: https://jubianchi.github.io/semver-check/#/~%3D2.38/2.39.0

Looks like we might have to do git~=2 which honestly is weird to me.

Seems ok to me, as long as it picks up the latest git security patch. If you're not comfortable with ~2, let's raise the pin to ~2.39.

nitrocode · 2023-01-23T05:43:54Z

Dockerfile

+# Install packages needed for building/verifying dependencies
+# hadolint ignore=DL3008,SC2261
+WORKDIR /tmp/build
+RUN apt-get update \


Why are these lines repeated on 180? Couldn't we install these packages just once in the debian release?

Good point, I can improve this.

Revisiting this, we re-install twice because we throw away the builder image which has more package installs, and this is a slimmed down install for the actual release image.

But now we have 2 places where we need to make sure these dependencies are up to date... Seems like extra maintenance and an easy thing to bump in one section and forget to bump in another

Dockerfile

deferring to pepe on this pr

This reverts commit 310aff8.

nitrocode · 2023-04-04T23:57:57Z

.github/workflows/atlantis-image.yml

@@ -56,6 +63,7 @@ jobs:
        images: |
          ${{ env.DOCKER_REPO }}
        labels: |
+          org.opencontainers.image.authors="Anubhav Mishra, Luke Kysow"


nit: This label seems no longer relevant as these authors are no longer actively maintaining the repo. I think we can omit this in the future

nitrocode · 2023-04-04T23:58:38Z

.github/workflows/atlantis-image.yml

+        context: .
+        platforms: linux/arm64/v8,linux/amd64,linux/arm/v7
+        push: ${{ github.event_name != 'pull_request' }}
+        tags: |


This seems incorrect. We started using the metadata tags in a recent pr.

I think this entire block can be removed

cc @jamengual @GenPage

nitrocode · 2023-04-05T00:00:12Z

Dockerfile

-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-RUN AVAILABLE_TERRAFORM_VERSIONS="1.0.11 1.1.9 1.2.9 1.3.9 ${DEFAULT_TERRAFORM_VERSION}" && \
+# In the official Atlantis image, we only have the latest of each Terraform version.
+RUN AVAILABLE_TERRAFORM_VERSIONS="1.1.9 1.2.9 1.3.9 ${DEFAULT_TERRAFORM_VERSION}" && \


Why was the shell argument removed?

nitrocode · 2023-04-05T00:07:58Z

Dockerfile.dev

@@ -1,7 +1,3 @@
 FROM ghcr.io/runatlantis/atlantis:latest
 COPY atlantis /usr/local/bin/atlantis


From the comments below, I don't think this image is needed anymore.

@jamengual

nitrocode · 2023-04-05T00:09:14Z

Dockerfile

+        openssl>=1.1.1n
+
+# install conftest
+# renovate: datasource=github-releases depName=open-policy-agent/conftest


This renovate comment should be directly before the conftest line

@jamengual @GenPage

nitrocode · 2023-04-05T00:10:59Z

@GenPage @jamengual could you folks give this one more review and please put in a follow up to address the above comments

nitrocode · 2023-04-05T00:12:15Z

Also it looks like this pr was merged without approval. Im unsure how that happened.

@lkysow please check repo settings when time permits. I think we need to remove pr approvers when new commits are pushed

It appears that when runatlantis#3001 combined the Dockerfiles, the bit that adds the `atlantis` user was not added to the Debian build stage Also correct some trailing spaces and missing EOL in `docker-compose.yml`

It appears that when #3001 combined the Dockerfiles, the bit that adds the `atlantis` user was not added to the Debian build stage Also correct some trailing spaces and missing EOL in `docker-compose.yml`

@nitrocode

* refactor: atlantis-image build pipeline and docker images Atlantis built and maintained two separate docker images, atlantis and atlantis-base. This made cutting releases cumbersome and had inefficiencies in the docker image layers. This PR condenses the workflow into a single job and Dockerfile once again by utilizing multi-stage builds more heavily and Docker build targeting. * fix: apply @nitrocode suggestions from code review * feat: hadolint * fix: DL4006 on go mod graph * fix: version regressions --------- Co-authored-by: nitrocode <[email protected]>

It appears that when #3001 combined the Dockerfiles, the bit that adds the `atlantis` user was not added to the Debian build stage Also correct some trailing spaces and missing EOL in `docker-compose.yml`

@nitrocode

) * refactor: atlantis-image build pipeline and docker images Atlantis built and maintained two separate docker images, atlantis and atlantis-base. This made cutting releases cumbersome and had inefficiencies in the docker image layers. This PR condenses the workflow into a single job and Dockerfile once again by utilizing multi-stage builds more heavily and Docker build targeting. * fix: apply @nitrocode suggestions from code review * feat: hadolint * fix: DL4006 on go mod graph * fix: version regressions --------- Co-authored-by: nitrocode <[email protected]>

It appears that when runatlantis#3001 combined the Dockerfiles, the bit that adds the `atlantis` user was not added to the Debian build stage Also correct some trailing spaces and missing EOL in `docker-compose.yml`

@nitrocode

) * refactor: atlantis-image build pipeline and docker images Atlantis built and maintained two separate docker images, atlantis and atlantis-base. This made cutting releases cumbersome and had inefficiencies in the docker image layers. This PR condenses the workflow into a single job and Dockerfile once again by utilizing multi-stage builds more heavily and Docker build targeting. * fix: apply @nitrocode suggestions from code review * feat: hadolint * fix: DL4006 on go mod graph * fix: version regressions --------- Co-authored-by: nitrocode <[email protected]>

It appears that when runatlantis#3001 combined the Dockerfiles, the bit that adds the `atlantis` user was not added to the Debian build stage Also correct some trailing spaces and missing EOL in `docker-compose.yml`

GenPage force-pushed the ci/refactor-atlantis-image-building branch from 8769a21 to 4d29519 Compare January 18, 2023 15:47

GenPage marked this pull request as ready for review January 18, 2023 16:03

GenPage requested a review from a team as a code owner January 18, 2023 16:03

jamengual approved these changes Jan 18, 2023

View reviewed changes

nitrocode reviewed Jan 18, 2023

View reviewed changes

Dockerfile.dev Outdated Show resolved Hide resolved

nitrocode reviewed Jan 18, 2023

View reviewed changes

Dockerfile Show resolved Hide resolved

nitrocode previously requested changes Jan 18, 2023

View reviewed changes

nitrocode reviewed Jan 18, 2023

View reviewed changes

Dockerfile Outdated Show resolved Hide resolved

nitrocode reviewed Jan 18, 2023

View reviewed changes

.github/workflows/atlantis-image.yml Outdated Show resolved Hide resolved

GenPage force-pushed the ci/refactor-atlantis-image-building branch from 4d29519 to 39e6484 Compare January 18, 2023 22:05

GenPage added build Relating to how we build Atlantis refactoring Code refactoring that doesn't add additional functionality area/build docker Pull requests that update Docker code labels Jan 18, 2023

nitrocode added github-actions and removed area/build labels Jan 21, 2023